Policy Overview
Custom Data Privacy
Detailed overview of each AltrumAI policy including purpose, features, and usage guidance.
Overview
The Data Privacy (Custom) Policy enables organisations to create highly tailored protections around sensitive information by selecting specific data types to monitor and manage in AI interactions. Unlike the standard Data Privacy Policy, which focuses on regulatory frameworks like GDPR or HIPAA, this version empowers users to configure protections based on custom-sensitive entities that reflect their unique compliance, operational, or industry needs. This flexibility gives organisations granular control over what constitutes “sensitive information” allowing them to apply detection and prevention strategies across both prompts and AI-generated responses.What the Policy Does
Purpose
The purpose of the Data Privacy (Custom) Policy is to protect custom-defined sensitive data by identifying and managing it in real time during LLM interactions. This policy is ideal for:- Organisations with internal data standards not covered by regulation.
- Companies operating in niche industries with unique sensitivity requirements.
- Teams wanting full control over entity-level filtering and monitoring.
Scope
Custom Entity Configuration
Users can select from a list of 52 predefined custom entities (e.g., email addresses, passport numbers, employee IDs, passwords, customer codes) to build a custom configuration.Prompt & Response Configuration
The policy can be applied to:- Prompts: Preventing sensitive data from being shared with the LLM.
- Responses: Ensuring that sensitive information is not surfaced back to the user.
Operational Modes
- Monitor Only: Records when sensitive entities are detected but does not block the interaction.
- Monitor & Override: Blocks prompts or responses that contain custom-sensitive data.
Key Features
- 52 Predefined Custom Entities: Covers a wide range of sensitive data types.
- Full User Control: Select exactly which entities to monitor.
- Independent Prompt/Response Filtering: Tailor enforcement across the full interaction flow.
- Flexible Enforcement Modes: Monitor-only or full blocking.
- Configurable to Any Environment: Supports internal governance or industry-specific standards.
Why Use This Policy?
Benefits
- Delivers fine-grained control over sensitive data handling.
- Addresses data categories not covered by standard regulatory frameworks.
- Reduces the risk of exposure across niche or specialised business functions.
- Strengthens internal governance through custom configuration.
Use Case: Global eCommerce Company
Scenario
An international eCommerce platform uses AI to generate customer service responses, product descriptions, and marketing content. Leadership wants to ensure that personally identifiable data (e.g., account numbers, internal codes, or order IDs) is not disclosed through AI interactions.Challenge
The organisation needs to:- Define sensitive data types that are not strictly regulated.
- Prevent their LLM from inadvertently generating or accepting content that includes internal identifiers.
- Enable selective enforcement depending on team and workflow.
Solution: Implementing the Data Privacy (Custom) Policy
-
Entity Configuration
Users select from 52 predefined entities including order IDs, internal references, and contact information. -
Prompt & Response Filtering
Enabled for both inputs and outputs. -
Operational Mode
Initially set to Monitor Only for insight.
Switched to Monitor & Override after analysis reveals frequent matches.
How to Use the Policy
Note: The steps below guide you through configuring the Data Privacy (Custom) Policy using the policy workflow interface.
Step 1: Navigate to the Policy Workflow
- From the Dashboard, open the Project Overview by selecting your project from the Project Table.
- In the Policy section of the Project Overview, click Edit Policy to launch the policy configuration workflow.
Step 2: Select and Enable the Data Privacy (Custom) Policy
- In the Configure Policies tab, a list of available policies will be displayed.
- Click on Data Privacy (Custom) to view its configuration options on the right-hand side.
- Toggle the Enable Policy switch to ON at the top of the panel to begin editing.
Step 3: Select Custom Sensitive Entities
- Under Entity Categories, you’ll see a set of expandable groups. Click on any group to reveal its entities:
- Personal Identification & Demographic
- Government and Legal Identifiers
- Contact & Online Presence
- Healthcare & Medical
- Financial and Banking
- Access Credentials & Security
- Organisational & Professional
- Temporal & Analytical
- Within each expanded category, check the boxes for the specific sensitive entities you want to monitor (e.g., email address, passport number, IP address).
- As entities are selected, they will appear as tags under the Selected Entities section for easy review and removal.
Step 4: Set Application Scope
- Under the Apply Policy To section, select where you want the policy enforced:
- Prompt – User inputs only
- Response – AI-generated outputs only
- Both – Full bidirectional coverage
Step 5: Configure Enforcement Behaviour
- Under Behaviour, choose how the policy should respond to detected sensitive data:
- Log Only – Capture and log entity violations without interruption.
- Log and Override – Block the interaction and return a smart, policy-aware response.
Step 6: Save, Test, and Apply the Policy
- Click Save Changes to store your selected entities and configuration.
- (Optional) Go to the Test Policies tab to evaluate how the policy behaves in real time with a chatbot.
- Return to the Configure Policies tab and click Apply Policies to enforce your changes across the project.
- A confirmation message will notify you that the policy has been successfully applied.
The Data Privacy (Custom) Policy provides precise, entity-level protection for sensitive information unique to your organisation—ensuring total control over data handling and policy enforcement.
Custom Entity Groups and Entities
| Group | Entity | Description |
|---|---|---|
| Personal Identification & Demographics | Name | Names of individuals, not including personal titles such as ‘Mrs.’ or ‘Mr.‘ |
| First Name | Names given to an individual, usually at birth; often first / middle names in Western cultures and middle / last names in Eastern cultures | |
| Family Name | Names indicating a person’s family or community; often a last name in Western cultures and first name in Eastern cultures | |
| Gender | Terms indicating gender identity or sexual orientation, including slang terms | |
| Date of Birth | Dates of birth | |
| Age | Numbers associated with an individual’s age | |
| Place of Origin | Terms indicating nationality, ethnicity, or provenance | |
| Country | Country names | |
| State | State, province, territory, or prefecture names | |
| City | Municipality names, including villages, towns, and cities | |
| Post Code | Zip codes (including Zip+4), postcodes, or postal codes | |
| Street Name | A subclass of “Address”, covering building number and street name, plus unit numbers, office numbers, floor numbers and building names | |
| Address | Full or partial physical mailing addresses | |
| Location | Meta-class for any named location reference | |
| Geographical Coordinates | Geographic positions referred to using latitude, longitude, and/or elevation coordinates | |
| Language | Names of natural languages | |
| Marital Status | Terms indicating marital status | |
| Religion | Terms indicating religious affiliation | |
| Political Affiliation | Terms referring to a political party, movement, or ideology | |
| Physical Attribute | Distinctive bodily attributes, including terms indicating race | |
| Username | Usernames, login names | |
| Government & Legal Identifiers | Passport Number | Passport numbers, issued by any country |
| Social Security Number | Social Security Numbers or international equivalent government identification numbers | |
| Driving License Number | Driver’s permit numbers | |
| NHS Number | Healthcare numbers and health plan beneficiary numbers | |
| IP Address | Internet IP address, including IPv4 and IPv6 formats | |
| Vehicle ID Number | Vehicle identification numbers (VINs), vehicle serial numbers, and license plate numbers | |
| Contact & Online Presence | Email addresses | |
| Contact Number | Telephone or fax numbers | |
| URL | Internet addresses | |
| Healthcare & Medical | Blood Group | Blood types |
| Medical Condition | Names of medical conditions, diseases, syndromes, deficits, disorders | |
| Medication | Medications, vitamins, and supplements | |
| Medical Procedure | Medical processes, including treatments, procedures, and tests | |
| Injury | Bodily injuries, including mutations, miscarriages, and dislocations | |
| Dosage | Medically prescribed quantity of a medication | |
| Medical Code | Codes belonging to medical classification systems such as SNOMED, ICD-10, NDC, etc. | |
| Professional Medical Name | Full names, including professional titles and certifications, of medical professionals | |
| Healthcare Facility | Names of medical facilities, such as hospitals, clinics, pharmacies, etc. | |
| Financial & Banking | Bank Account Number | Bank account numbers and international equivalents, such as IBAN |
| Credit Card Number | Credit card numbers | |
| Credit Card Expiry Date | Expiration date of a credit card | |
| CVV | 3- or 4-digit card verification codes and equivalents | |
| Cardholder Name | Name on the front (or sometimes the back) of credit card or debit card | |
| Card PIN | A four- or six-digit number that the cardholder sets up when opening their account | |
| One-time PIN | One-time Password or OTP sent to Registered Mobile Number for online transactions | |
| Account Number | Customer account or membership identification number | |
| Swift code | Routing number associated with a bank or financial institution | |
| Money | Names and/or amounts of currency | |
| Access Credentials & Security | Password | Account passwords, PINs, access keys, or verification answers |
| Organisational & Professional | Organisation | Names of organisation or departments within an organisation |
| Temporal & Analytical | Date | Specific calendar dates, which can include days of the week, dates, months, or years |
| Date Range | Broader time periods, including date ranges, months, seasons, years, and decades | |
| Statistics | Medical statistics | |
| Filename | Names of computer files, including the extension or filepath (if used in data analysis or reports) |